Checkmk CVE-2025-39663

Exploitation requires a Checkmk deployment running in distributed monitoring mode with at least one remote site, and the attacker must already control or have compromised a remote site (reflected as PR:H) so it can emit crafted service output. The payload only fires when a user on the central site passively views the affected service output (UI:P). Limiting factors: single-site/standalone Checkmk installations are not affected; the attacker needs a privileged foothold on a remote site rather than mere network reach; and a central-site operator must actually open the poisoned view. End-of-life 2.1.0 receives no fix, so those deployments remain exposed.

This is a stored/transmitted Cross-Site Scripting flaw (CWE-80) specific to Checkmk's distributed monitoring topology, where a compromised remote site injects malicious HTML into service outputs that render in the central site. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H) yields 8.5 (High), but the real-world risk is gated by two significant preconditions baked into the vector itself: PR:H means the attacker must already control/compromise a remote monitoring site (a privileged position in the distributed hierarchy), and UI:P means a central-site user must passively view the poisoned service output for the payload to fire. Publicly available exploit code exists (SBA Research advisory and a Full Disclosure post), which raises the practical threat, but this is NOT listed in CISA KEV and no EPSS probability was supplied, so there is no evidence of active or widespread exploitation - the POC signal and the active-exploitation signal are distinct and only the former is present. Net: a genuine, patch-worthy High for organizations running distributed Checkmk where remote sites may be less trusted, but the PR:H precompromise requirement makes this a lateral-movement/trust-boundary issue rather than an internet-facing unauthenticated drive-by, so it should rank below any remote-unauthenticated RCE in triage. Note the VC:H/VI:H/VA:H impact rating is aggressive for an XSS and appears to assume full central-site account takeover; availability impact in particular is questionable for a scripting flaw.

An attacker who has compromised or operates a remote Checkmk monitoring site configures a monitored service to return output containing malicious HTML/JavaScript. When an administrator or operator on the trusted central site opens the affected service view, the injected script executes in their authenticated browser session, enabling session/credential theft or actions in the central UI. A public proof-of-concept for this injection is available from SBA Research and Full Disclosure.